A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1404 advisory.

    Bypass File System Permissions using crafted symlinks (CVE-2025-55130)

    A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are     interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers     allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover data from     previous operations, allowing in-process secrets like tokens or passwords to leak or causing data     corruption.

    While exploitation typically requires precise timing or in-process code execution, it can become remotely     exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality     and integrity impact. (CVE-2025-55131)

    fs.futimes() Bypasses Read-Only Permission Model (CVE-2025-55132)

    Memory leak that enables remote Denial of Service against applications processing TLS client certificates     (CVE-2025-59464)

    Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame (CVE-2025-59465)

    Uncatchable Maximum call stack size exceeded error on Node.js via async_hooks leads to process crashes     bypassing error handlers (CVE-2025-59466)

    TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak

    NOTE: https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#tls-pskalpn-callback-     exceptions-bypass-error-handlers-causing-dos-and-fd-leak-cve-2026-21637---medium (CVE-2026-21637)

    Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the     decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert     thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability     is fixed in 7.18.0 and 6.23.0. (CVE-2026-22036)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8663c5f961 advisory.

    Update to version 22.22.0





Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b7ad50870e advisory.

    Update to version 22.22.0



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fb4878551d advisory.

    Update to version 20.20.0



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-cc863e84da advisory.

    Update to version 24.13.0.




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f601b2f60a advisory.

    Update to version 20.20.0

    ----

    Update to version 20.19.6




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5cd409edfa advisory.

    Update to version 24.13.0




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A memory leak in Node.js's OpenSSL integration occurs when converting X.509 certificate fields to UTF-8     without freeing the allocated buffer. When applications call socket.getPeerCertificate(true), each     certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated     TLS connections. Over time this can lead to resource exhaustion and denial of service. Impact: This public     CVE is only issued for the affected 24.x releases. Thank you, to giant_anteater for reporting this     vulnerability and thank you RafaelGSS for fixing it. (CVE-2025-59464)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Node.js installed on the remote host is prior to 20.20.0, 22.22.0, 24.13.0, 24.13.0, 25.3.0. It is, therefore, affected by multiple vulnerabilities as referenced in the Tuesday, January 13, 2026 Security Releases advisory.

  - A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via     futimes() even when the process has only read permissions. Unlike utimes(), futimes() does not apply the     expected write-permission checks, which means file metadata can be modified in read-only directories. This     behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs     (CVE-2025-55132)

  - A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are     interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers     allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover data from     previous operations, allowing in-process secrets like tokens or passwords to leak or causing data     corruption. While exploitation typically requires precise timing or in-process code execution, it can     become remotely exploitable when untrusted input influences workload and timeouts, leading to potential     confidentiality and integrity impact. Impact: Thank you, to Nikita Skovoroda for reporting and fixing this     vulnerability. (CVE-2025-55131)

  - A flaw in Node.js's Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write     restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted     access only to the current directory can escape the allowed path and read sensitive files. This breaks the     expected isolation guarantees and enables arbitrary file read/write, leading to potential system     compromise. Impact: Thank you, to natann for reporting this vulnerability and thank you RafaelGSS for     fixing it. (CVE-2025-55130)

  - A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by     triggering an unhandled TLSSocket error ECONNRESET. Instead of safely closing the connection, the process     crashes, enabling a remote denial of service. This primarily affects applications that do not attach     explicit error handlers to secure sockets, for example: server.on('secureConnection', socket => {     socket.on('error', err => { console.log(err); }); }); JavaScriptCopy to clipboard Impact: Thank you, to     dantt for reporting this vulnerability and thank you RafaelGSS for fixing it. (CVE-2025-59465)

  - We have identified a bug in Node.js error handling where Maximum call stack size exceeded errors become     uncatchable when async_hooks.createHook() is enabled. Instead of reaching process.on('uncaughtException'),     the process terminates, making the crash unrecoverable. Applications that rely on AsyncLocalStorage (v22,     v20) or async_hooks.createHook() (v24, v22, v20) become vulnerable to denial-of-service crashes triggered     by deep recursion under specific conditions. This patch improves recoverability in one edge case, but it     does not remove the broader risk. Recovery from space exhaustion is unspecified, besteffort behavior and     is not a reliable basis for availability or security. In availabilitycritical paths where recursion depth     may be influenced by untrusted input, prefer input validation and designs that bound or avoid recursion     rather than depending on stack space exhaustion behavior or the lack of tailcall optimizations in the     runtime/engine. See this blog post for details. Impact: Thank you, to Andrew MacPherson (AndrewMohawk) for     identifying & aaron_vercel for reporting this vulnerability and thank you mcollina for fixing it.
    (CVE-2025-59466)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
298098	Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-1404)	Nessus	Amazon Linux Local Security Checks	medium
297452	Fedora 43 : nodejs22 (2026-8663c5f961)	Nessus	Fedora Local Security Checks	medium
297446	Fedora 42 : nodejs22 (2026-b7ad50870e)	Nessus	Fedora Local Security Checks	medium
297445	Fedora 42 : nodejs20 (2026-fb4878551d)	Nessus	Fedora Local Security Checks	medium
297444	Fedora 42 : nodejs24 (2026-cc863e84da)	Nessus	Fedora Local Security Checks	medium
297442	Fedora 43 : nodejs20 (2026-f601b2f60a)	Nessus	Fedora Local Security Checks	high
297441	Fedora 43 : nodejs24 (2026-5cd409edfa)	Nessus	Fedora Local Security Checks	medium
283720	Linux Distros Unpatched Vulnerability : CVE-2025-59464	Nessus	Misc.	high
282656	Node.js 20.x < 20.20.0 / 22.x < 22.22.0 / 24.x < 24.13.0 / 24.x < 24.13.0 / 25.x < 25.3.0 Multiple Vulnerabilities (Tuesday, January 13, 2026 Security Releases).	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-59464

high

Tenable Plugins

medium

medium

medium

medium

medium

high

medium

high

medium